Protect your wp-config.php file

The password to your database is stored as plain, readable text in your configuration file (wp-config.php). Access to your database gives hackers control over your complete site, so to say you need to protect it is stating the obvious.

The first and most obvious step is to ensure the permissions are set correctly.
Some servers set the wrong permissions by default which allows anyone who wants to the ability to read the contents of that file.

The permission should be set using SSH or through an FTP client to 640
chmod 640 wp-config.php

Additionally you should move the wp-config.php out of the main WordPress directory.
For example if your wp-config.php is located at root level – /public_html/wp-config.php – move it down one level below – wp-config.php/public_html.